Christopher Docksey, Hielke Hijmans

European Data Protection Law Review, Volume 5 (2019), Issue 3, Page 300 - 316

In this article we discuss the main trends in the recent case law of the CJEU, following the three landmark cases of Digital Rights Ireland, Google Spain, and Schrems. The CJEU has followed a broad approach to scope and a strict approach to exceptions, ensuring that where personal information is processed there will be one or more controllers who will be accountable for such processing. The Court has also recognised that data protection requires a balancing with other fundamental rights such as freedom of expression, and has followed a common sense approach that allows personal information to be processed in a proportionate manner for legitimate purposes. We conclude that the case law has had a positive impact on the data protection legal framework and that the CJEU is likely to maintain its approach in order to ensure that the GDPR is fully effective. Keywords: Case Law, CJEU, Accountability, Fundamental Rights, GDPR

Hielke Hijmans

European Data Protection Law Review, Volume 4 (2018), Issue 1, Page 80 - 84

Hielke Hijmans

European Data Protection Law Review, Volume 3 (2017), Issue 3, Page 406 - 412

Opinion 1/15 of the Court of Justice of the European Union of 26 July 2017 pursuant to Article 218(11) TFEU on the Draft agreement between Canada and the European Union (Passenger Name Records; PNR), ECLI:EU:C:2017:592. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data OJ L 281/31). Council Directive 2004/82/EC of 29 April 2004 on the obligation of carriers to communicate passenger data (OJ 2004 L 261/24, ‘Directive 95/46’). Convention on International Civil Aviation, signed at Chicago on 7 December 1944 (United Nations Treaty Series, Volume 15, No 102, ‘the Chicago Convention’).

Hielke Hijmans

European Data Protection Law Review, Volume 2 (2016), Issue 3, Page 362 - 372

This article discusses the Europeanisation of enforcement by DPAs. The GDPR increases the European dimension of the DPAs' task and introduces a one stop shop mechanism with a lead DPA and a consistency mechanism. These changes aim at creating a level playing field, whilst respecting powers of national authorities. The article shows that it is not easy to reconcile these two purposes and that the relevant provisions of the GDPR are ambiguous. Much will depend on how the cooperation mechanisms of DPAs will be put into practice. The article suggests that the EDPB adopts guidelines to stimulate the DPAs to use the cooperation mechanisms in a proactive manner.

Hielke Hijmans

European Data Protection Law Review, Volume 1 (2015), Issue 2, Page 149 - 152

Case C-212/13, František Ryneš v Úřad pro ochranu osobních údajů, Judgment of 11 December 2014, Opinion Advocate General Jääskinen of 10 July 2014.